Riven Edge Proxy
LiveThe public edge: TLS termination, hostname routing, rate limiting, and security headers in front of every surface and the gateway.
Every request to a Riven hostname arrives at Edge Proxy first. It is the layer that decides which service owns a hostname, that requests do not exceed their allowance, and that responses carry the right security headers.
What it does#
- TLS termination — certificates issued and renewed automatically, including for Pages custom domains.
- Hostname routing — maps
rivenai.io,api.rivenai.io,console.rivenai.io,studio.rivenai.io, and the rest onto their Swarm services. - Rate limiting — per-key and per-IP burst control, ahead of plan-level accounting so abusive traffic never reaches the gateway.
- Security headers — HSTS, CSP,
X-Content-Type-Options,Referrer-Policy, andPermissions-Policyapplied uniformly. - Health-gated rollout — traffic only shifts to a new container once its health check passes, which is what makes an image update a non-event.
The stack#
The edge is Traefik, with deployments driven by Dokploy over Docker Swarm. Nothing in the delivery path depends on a managed application platform, which is what allows an identical topology to be stood up inside a customer datacentre.
Riven headers you will see#
| Header | Meaning |
|---|---|
X-Riven-Surface | Which surface served the response, e.g. website |
X-Riven-Version | Build identifier of the serving container |
x-riven-upstream | On API responses: the inference pool that answered — set by Ultra Router |
X-RateLimit-Limit / -Remaining | Edge burst allowance for the current window |
A 429 from the edge is a burst limit and carries retry_after_ms — back off and retry. A 429 with type: "plan_limit" came from the gateway instead and means the model is not on your plan, where retrying will not help. See Errors.